Cybersecurity Risk Assessment for Safety-Critical Systems

Overview: Dr. Lee Vessels, cybersecurity architect at Honeywell, alongside co-authors Dr. Daniel Johnston and Dr. Kenneth Hefner, presents a risk assessment framework designed specifically for safety-critical cyber-physical systems. Focusing on space systems, satellite communications (SATCOM), and avionics, the talk examines the operational vulnerabilities that threaten physical safety and national critical infrastructure. Dr. Vessels introduces a structured five-step iterative assessment methodology that bridges the gap between traditional enterprise threat modeling and the rigorous airworthiness certification standards enforced by the FAA.

Key Topics: - Safety-critical cyber-physical attack vectors across space systems, satellite communications, and avionics - Shortcomings of enterprise threat modeling when applied to complex cyber-physical environments - Foundational principles of the SAE G-32 cyber-physical systems security standard and FAA airworthiness processes - A five-step iterative risk assessment framework: defining security perimeters, asset scoping, and attribute scoring

Technical Details: The presentation details the historical vulnerability landscape of safety-critical space and aviation systems. Beginning with a 2014 industry evaluation of 10 commercial satellite communication products, researchers uncovered ubiquitous security flaws, including undocumented maintenance backdoors, hardcoded administrative credentials, unencrypted communication channels, and exposed interfaces that permitted unauthenticated remote dial-in access. Subsequent analyses in 2018 documented operational impacts, including the disruption of onboard satellite transponders, manipulation of commercial in-flight Wi-Fi, geolocation tracking of military units, and spoofing of critical navigation feeds. These risks culminated in real-world incidents, such as the June 2019 compromise of NASA Jet Propulsion Laboratory (JPL) systems that allowed adversaries to pivot into the Deep Space Network.

Dr. Vessels explains why conventional enterprise threat modeling frameworks fail when applied to safety-critical cyber-physical architectures. Traditional methodologies require specialized security and mathematical competencies that are rarely combined with deep domain engineering knowledge. Furthermore, manual assessment approaches require up to 2,000 engineering hours (a full man-year) per system, making them unscalable across complex aerospace constellations while introducing human error that undermines strategic risk calculations. To resolve these limitations, Honeywell developed an iterative, repeatable risk assessment framework that now underpins the SAE G-32 standard and the FAA's airworthiness security certification processes.

The framework is structured as an iterative five-step engineering process that supports continuous 'what-if' analyses. Step one establishes the security architecture by defining precise security perimeters—notional boundaries separating distinct security contexts—rather than arbitrarily drawing boxes around physical hardware. Engineers identify critical mission assets within the perimeter, map all external interfacing systems and human actors, and formally document existing physical and logical communication links. Step two performs attribute scoring, identifying external threat actors and modeling attack paths against perimeter protections, including network security and radio frequency (RF) spectrum defenses, to evaluate exploit feasibility before committing to physical system fabrication.

Key Takeaways: Safety-critical space, satellite, and avionics systems require dedicated cyber-physical risk assessment methodologies rather than repurposed enterprise threat modeling tools. System architects must explicitly define notional security perimeters and inventory all external RF and network interfaces to prevent lateral movement into mission-critical networks. Organizations should adopt iterative, standardized assessment frameworks like SAE G-32 to validate security controls and achieve repeatable compliance across complex operational lifecycles.

(AI summary — Gemini Flash)